From e25b91acfd440bafe09abd6b11340eabf6c2fd53 Mon Sep 17 00:00:00 2001
From: Madhura Jayaratne <madhura.cj@gmail.com>
Date: Tue, 30 Jan 2018 12:36:04 +1100
Subject: [PATCH] Escape search string and table names in database search
 results page

Thanks to Jon Caz 1 for reporting the issue

Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
---
 templates/database/search/results.twig | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/templates/database/search/results.twig b/templates/database/search/results.twig
index efe5529615..ebd7c0b8d1 100644
--- a/templates/database/search/results.twig
+++ b/templates/database/search/results.twig
@@ -3,7 +3,7 @@
         {{ 'Search results for "<em>%s</em>" %s:'|format(
             criteria_search_string,
             search_type_description
-        )|raw }}
+        ) }}
     </caption>
     {% for row in rows %}
         <tr class="noclick">
@@ -15,7 +15,7 @@
                         %1$s matches in <strong>%2$s</strong>
                     {% endtrans %}
                 {% endset %}
-                {{ result_message|format(row.result_count, row.table)|raw }}
+                {{ result_message|format(row.result_count, row.table) }}
             </td>
             {% if row.result_count > 0 %}
                 {% set url_params = {